December 2, 2008

[Valentina] Kunasz said despite all the debate outside the courtroom about the prosecution's use of an anti-hacking statute to charge Drew for violating a web site's terms of service, jurors never considered whether the statute was appropriate. However, she said she agrees with the idea that users who violate a web site's terms of service should be prosecuted.

"The thing that really bothered me was that (Drew's) attorney kept claiming that nobody reads the terms of service," she said. "I always read the terms of service. . . . If you choose to be lazy and not go though that entire agreement or contract of agreement then absolutely you should be held liable."

Should it be considered a serious, federal crime to violate a website's terms of service? Remember when a blogger set up a Facebook page using my name? That violated Facebook's Terms of Use. ("[Y]ou agree not to use the Service or the Site to... impersonate any person or entity, or falsely state or otherwise misrepresent yourself, your age or your affiliation with any person or entity....") The blogger in question appeared in the comments to my post and confessed and bragged about his behavior. (I've preserved all his comments in case he now thinks it's worth his trouble to delete them.)

Now, I pursued the remedy I cared about: I got Facebook to delete the page. But imagine if some federal prosecutor went after him. It would be utterly abusive, in my view, and a violation of freedom of speech, but how is it different from what happened to Lori Drew?

I expect you to say that the blogger's hoax didn't cause a death. Okay, then let's make it a hypothetical: His taunting is severe and it drives me to commit suicide.

But he right answer is that Lori Drew's case was different because she was accused of using the website in order to obtain information about Megan Meier:

Drew... was convicted of helping create a fake MySpace account for a non-existent 16-year-old boy named "Josh Evans" to woo Megan and determine if Megan was spreading rumors about Drew's then-13-year-old daughter Sarah. According to testimony during the trial, Ashley Grills a then-18-year-old employee of Drew, created the "Josh Evans" account with Drew's approval and conducted most of the communication between "Josh" and Megan.

The federal statute used by the prosecutor -- 18 U.S.C. § 1030 -- is about unauthorized access of a computer and obtaining information.

I agree with the jury forewoman that there should be a law, apparently there is not, that any illegal action that results in the death of another is accessory to that death.

What is it that parents become psychotic obsessives in protecting their children from the vicissitudes of life? This sort of behavior is reminiscent of the Kitty Genovese murder in Queens in 1964. There is a dark side to humanity that devalues life when it is convenient, or inconveniet as the case may be.

Agreed, FH - the rule of law is more important than she is. I'd like to think, that in cases like this, that justice will eventually be served - sent upstairs and a verdict rendered 'upon further review.'

There was a level of maliciousness in the Drew case that isn't present in the faux Althouse-Facebook brouhaha. And remember, Lori Drew was an adult, fucking around with a child, which is seriously deranged. Althouse is not a child. She can hold her own.

I would have more sympathy for the prosecution trying to use some law that prohibits child abuse, including emotional abuse, or harassment.

I'm also not sold on the idea that being an ass should be a crime based on whether or not the someone you're an ass to kills himself. Either what you're doing is illegal or not, but the fact that another person goes out and murders himself should not, I think, bear on legality.

To me, this case is special, not because the girl killed herself, but because the girl was merely a girl, and Drew was an adult, therefore Drew's behavior was abusive and violates the special protection we afford children from adult maleficence.

When the law doesn't provide for punishment of something truly heinous, or when proof is lacking, the inclination will always be to find some way to shoehorn the case into something the law does provide for punishment of, or for which proof is available. Remember, they got Capone on tax evasion. Drew had better keep her nose clean.

I agree with you that such a prosecution would be abusive. But it would hardly be a violation of freedom of speech.

Freedom of speech does not grant one the right to enter into an agreement (such as accepting the terms of a service agreement) and then just ignore the restrictions.

Freedom of speech does not grant an individual the right to whatever microphone is around. The owner of the microphone has the right to who gets to use it, and under what conditions. To take that right away would be to infringe on the owners' freedoms of speech and of free association.

The wrong approach, though, is to pursue such abuses through further abuse of the criminal justice system. The right approach is for it to be culturally unacceptable to behave in this manner, instead of trying to romanticize it as some protected expression of speech.

"Zachary Paul Sire said...There was a level of maliciousness in the Drew case that isn't present in the faux Althouse-Facebook brouhaha. And remember, Lori Drew was an adult, fucking around with a child, which is seriously deranged. Althouse is not a child. She can hold her own."

But the statute has nothing to do with whether the target is a child. This case sets a precedent for prosecuting someone who uses a website to get information and has violated the terms of service (thus making the access to the site "unauthorized"). If you want that to be a crime, it's a crime across the board, and you've probably committed it.

Now, if your argument is you think there should be some dipshit crimes that everyone commits so that prosecutors can get convictions whenever there's someone they'd like to convict for some completely other reason, then you support lawless, abusive government.

A suicide is a singularity, a black hole that distorts the perception of every person in the neighborhood of that singularity. I had a friend with some type of dystrophic disease that left her in intractable pain. She would call me frequently and complain about her doctors. She felt that there was a cure for her ailment and that the doctors were not trying hard enough. Her stories were long and tedious, and sometimes I lost interest. One time she told me that she was contemplating suicide... That got my attention. I knew I was out of my depth and told her that she should go to a psychiatrist and talk this out. She got mad at me. She said she should see a psychiatrist for even talking to someone like me. That was the last time she called me. I never called her. I was just as glad to be done with her perpetual sorrows. I had troubles of my own.....Several months later I heard that she had committed suicide. I know that my indifference was not the cause of her suicide, but I also know that my indifference was part of the sum total of human misery that pushed her over the edge....Apparently quadriplegia and intractable pain are the two physical ailments that the human spirit cannot overcome. I know this as a fact because I participated in her death, and it is important that everyone, especially me, know that I did not participate in her death.....I think something like this is going on in the Lori Drew case. Very few children pass through adolesence without encountering the malice of a few adults. Lori Drew was a woman of considerable malice but she was not omnipotent. It is absolutely essential for the mother of Megan and for her friends and teachers to throw as much of the blame on Lori Drew as possible. It diminishes their own guilt....I wish God existed so that on the day of Last Judgement he could exactly apportion your involvement in the world's evil and there would be an end to second guessing.

Now, if your argument is you think there should be some dipshit crimes that everyone commits so that prosecutors can get convictions whenever there's someone they'd like to convict for some completely other reason, then you support lawless, abusive government.

Exactly! And Drew's being a monster is far less monsterous than the possibilities of giving prosecutors this power.

I don't know why she wasn't brought up on some sort of child abuse charges. No one seems to care nor did they consider it particularly disgusting that this was an adult woman deliberately toying with a child's mind over the internet.

At the very least, how is she fit to be a mother?

I argued over and over again (in another comment thread) that she should have been charged with pedophilia or treated as a sex offender. The question I asked then and will ask again now is how is molesting a child's mind any different than molesting her body?

"Why isn't this Ashley Grills person in trouble? She was eighteen, and she set up the account. Why doesn't anyone care about her?"

From what I understand, she was given immunity to testify against Lori Drew, and it was only during the trial that it came out the idea was hers. So from where I sit, I'd say the reason this happened this way was because the prosecutor f'd it up.

"The federal statute used by the prosecutor -- 18 U.S.C. § 1030 -- is about unauthorized access of a computer and obtaining information."

From an IT security perspective, I fully accept that social hacking is still hacking; it doesn't matter if I get a password via a keyboard sniffer, a decryption of the password hash, or by fooling a service representative into giving it to me. I've still compromised system security.

However, I feel like there's a problem with social hacking being an electronic crime from a legal perspective. I haven't worked it all out in my mind yet, so this is mostly knee-jerk opinion, but a case like this being prosecuted under this specific statute just doesn't seem right. Yes, someone died. How does that make "The People" the ones who have standing to pursue Ms. Drew about a violation of her contract with Myspace?

Yes, Ms. Drew is a horrible person, and deserves punishment of some kind, but this specific prosecution didn't even reach the tenuous level of association of Capone-tax evasion. The law in question here covers violating a system's security to obtain protected information from the system, not about violating a TOS - something damn near everyone inadvertently does every day anyway - to mess with another person.

I mentioned this elsewhere, but creating a legal system in which it becomes impossible to behave legally, in the sense that you can always be found to be in some violation of some rule or law (or here, the TOS) means that everybody can be found guilty of something, that all are criminals to the State, and it merely needs to decide what it wants from you and demand it, because it can always destroy you (e.g. the IRS).

The problem is that this case went to criminal court at all. Meier ought to turn around and sue her lawyers for being complete idiots. If this had been a civil case, it would have been open-and-shut. Instead, Meier's lawyers figured that this would be their Big Break and they'd go for broke. Unfortunately, they couldn't come up with anything meaningful to hang on Drew, so they went with this two-bit "TOS violation" thing.

Yep. I agree with Pogo and halojones-fan. I'm not about to say that one, single misstep on the prosecutor's part is totalitarianism, but it's an uncomfortable step towards abuse of power. And that's why I agreed with Professor Althouse's statement in a previous thread: It was an abusive prosecution. That fact is somewhat obscured by the fact that a terrible person who committed a terrible deed was involved, but it doesn't change the fact one whit.

And HJF is right too: The real injury is to the Meier family, so why was the prosecution done in a criminal court involving harm supposedly done to Myspace? Logically, the choice of statutes to prosecute Ms. Drew under suggests that the real harm was done to Myspace, not to the Meiers. And that was a ridiculous way to have painted things.

I agree with William. The disturbing thing with this case is the assertion that Lori Drew caused a suicide. That is a mammoth stretch. Most people are called terrible things; I've been called worse things than what happened in this situation, yet we don't commit suicide.

Factually, it's not even certain Megan's committed suicide. There was a token autopsy and a rush to cremation; how do we know she wasn't murdered? How do we know it wasn't an accidental death? Was she into auto-asphyxiation? The parents have repeatedly changed their story about the events of that day; how do we know there wasn't a massive fight between them and their child, she stormed into the room, decided to scare them and it went wrong?

(And, according to the original story, it was quite apparent that the father deleted some content off the MySpace account. It was claimed that the forensic computer people couldn't find some messages; but those messages don't just magically disappear. Lori Drew is a vile person, but I fear she's been made a scapegoat in a very complex situation.)

PS. My dissent here will raise the ire of many readers. That's a real problem. Was Lori Drew convicted fairly? Or was the jury so swayed by emotion that it really didn't matter what she was charged with. That is something we should be very concerned about, especially with the increase of "hate" speech laws.

I know this as a fact because I participated in her death, and it is important that everyone, especially me, know that I did not participate in her death.....I think something like this is going on in the Lori Drew case.

And this is why I found the claims that Megan's parents did something wrong by not protecting her by denying her an on-line friendship that might go bad so terrible.

By that reasoning Lori Drew was the far better mother, even a perfect mother, because she was protecting her daughter from the slings and arrows of unpopular childhood.

If "You're supposed to me on my side!" was a legitimate charge to her mother and required, even knowing her daughter was having trouble, a 24 hour suicide watch, then every last one of us with children are screwed.

The exchange with the "boy" sounded like the sort of thoughtless cruelty of children and if it was real we'd feel bad, but probably not blame him. Teens are likely to see their social world crumble with seeming permanence several times before they get through those years.

As others have said, the difference here was that we found out it was an adult, f*cking with a child's mind on purpose.

I'm persuaded that I'm wrong to not care about the abusive prosecution. I'm going to try to care about it, in this case. Tough to do, because I did happen to follow the reporting on this case, and I do think Lori Drew deserves punishment. I'm sorry there is nothing that really fits here to make most people comfortable charging her with.

But obviously, the people that are arguing that this is an uncomfortable step are right, and I thank you for your comments.

Some people here have suggested that Lori Drew should be jailed because she messed with a kid's head on the net. People do that all the time without using computers (most religions/cults/environmental activists in my opinion) and no one goes after them for making a kid crazy.

Also Lore Drew didn't steal information off some server (like a person's medical records). Under the guise of Josh Evans she enticed the girl to reveal personal information willingly. If it's illegal to get information using a false identity, are we now going to prosectute people who set up a false account and then go to some site to read, say, the text of bills pending before Congress?

Dori Drew is a despicable person but I'd rather see her go free than to allow a prosecutor twist a statue so he can convict someone in a situation currently not covered by existing law. The Missouri authorities were entirely correct in deciding they didn't have the authority to prosecute Drew. Furthermore they showed moral courage in making a decision which was no doubt unpopular in the state.

That should have been the end of this case. Instead the US Attorney in southern California starts a prosecution here on the (irrelevant) grounds that the servers were located here? If we are going to allow a prosecutor claim jurisdiction on tenuous grounds like that, the next time a case comes around we are going to have the US Attorney for Arizona wanting to take the case on the grounds that the electricity to power the servers was generated there.

I don't even know why the US Attorney here even wants to prosecute Drew, unless he intends to run for governor when Schwarzenegger's term ends.

Joe: You know, you're right. It's not out of the realm of possibility that Red Lectroids from Dimension Ten manifested in Megan's room and sucked the very life-energy out of her body. Unless the prosecution can PROVE beyond the SHADOW OF A DOUBT that there is NO SUCH THING as Red Lectroids from Dimension Ten, then Lori Drew is CLEARLY innocent of any wrongdoing, and in fact we're the real monsters here for treating her so badly.

We don't know the suicide was a consequence of anything Lori Drew did or cause to have done. That's one of the most disturbing part of this blame game; correlations are being turned into causations with very little actual evidence. Megan had a history of psychiatric illness and argued with both her parents the day of her apparent suicide--her argument with her mother was allegedly quite vicious.

(This is not to excuse the immaturity of Lori Drew's actions, but I fear we are opening Pandora's box of thought crimes a bit too eagerly.)

Ann suggests that the "obtaining information" angle may be significant. The statute certainly talks about unauthorized access for the purpose of obtaining information, but I don't think that factor can rescue this prosecution. And almost any use of the Internet results in "obtaining information." The person who created the fake Althouse page on Facebook may well have obtained information by doing so -- surely there was some information on the Facebook page posted by someone other than him, and thus he "obtained information" even if it may have been trivial.

In all events, the real problem with this prosecution is that it expands beyond recognition what Congress meant to criminalize as an "unauthorized" access to a computer. The prosecution's theory is contractual, in that a violation of a site's TOS makes any access to a computer behind that TOS wall unauthorized by definition. It seems highly unlikely that Congress had any such thing in mind. After all, it was billed as an anti-hacking statute, and no one would describe what Drew did as a form of hacking.

The problem with the prosecution's TOS theory is that a TOS cannot reasonably be used, and is not realistically ever intended to function, as a control over access to any of the free sites on the Internet. Instead, it's a liability protection device for the site operators.

It is unlikely that Drew's access of the MySpace site in violation of the TOS was even a technical breach of contract. One of the elements of any breach of contract claim is proof that the breach caused damages. Here MySpace was not damaged by her accessing its site. But that's just another way of saying that MySpace wasn't using the TOS to control access, and the TOS didn't function that way. The kind of violation of the TOS committed by Drew was, as far as MySpace was concerned, a non-event.

Eugene Volokh and Orin Kerr are both of the view that the 9th Circuit will reject the prosecution's theory that a violation of the TOS = unauthorized access. I hope they're right. Otherwise, as Ann suggests, any violation of a free site's TOS can be prosecuted at the whim of a prosecutor -- the anti-hacking statute will have been turned into the Internet's version of the vagrancy statutes of old, invoked whenever the constable wants to make life miserable for undesirables.

Hold it halojones-fan, there is very little evidence of what actually happened in Megan's room. You are creating a massive story based on the hearsay of a handful of people who have a great vested interest in their side of the story and who are quite bitter (never forget that Megan's parents and Lori Drew had a nasty dispute going on wherein Megan's parents acted like asses.) Truth is, we don't even know for a fact that Megan committed suicide--her body was cremated before a thorough autopsy could be performed.

And nobody, NOBODY, is saying it's okay to cause mental distress to another. The question is whether this is now a felony. If we are going to go down that path, are we to prosecute a person who breaks off an engagement? Or who refuses to go on a date with someone and says something mean? How about prosecuting children on the playground who say the most horrible things?

We should strive to make a better world, but turning speech into crime really is a slippery slope into world where anyone could be prosecuted for anything on the whim of those in power.

This *nasty* dispute that was going on... it was so nasty that after Megan died, the Drews asked them to hide a Christmas present in their garage and they agreed.

Wow... way nasty dispute, eh?

Sure, after they heard that Drew was involved in the events that led up to their daughter's death (and yes, I also have wondered if the suicide attempt was a drama attempt that went wrong) then they dumped the foosball table on the Drew lawn and rendered it to splinters... but wouldn't you?

I mean... the gall... Lori Drew knew what she'd done and she asks them to hide a present in their garage?

Section 1030 is about a LOT of things, or at least it's been used that way.

A few years ago, it was used in a class action lawsuit in the Eastern District of Texas, Beaumont Division, to extort a settlement valued for accounting purposes at $3BN, and certainly worth something like $1BN in real-world dollars (including hundreds of millions in attorneys' fees), against Toshiba on the basis that its floppy disk drives contained microcode that could falsely report that data had been written to a sector on the floppy disk when it actually hadn't. This was an error that could be induced in weeks of bench-testing with continuous read-writing exercises, but it had never actually been documented as having occurred a single time in the real world.